Add explict allow deny commands.

2026-08-06 10:45:45 -04:00
parent a3f0f8a1be
commit c15a1cc14c
15 changed files with 566 additions and 13 deletions
@@ -47,6 +47,7 @@ func TestConfigFromEnv(t *testing.T) {
 	t.Setenv("GOOGLE_AUTH_AUTH_HOST", "HTTPS://Auth.Example.com/")
 	t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "Signal.org, @example.com")
 	t.Setenv("GOOGLE_AUTH_ALLOWED_EMAILS", "Guest@Partner.com")
+	t.Setenv("GOOGLE_AUTH_DENIED_EMAILS", "Former@Signal.org example@example.com")
 	t.Setenv("GOOGLE_AUTH_SESSION_TTL", "48h")

 	cfg, err := ConfigFromEnv()
@@ -62,6 +63,9 @@ func TestConfigFromEnv(t *testing.T) {
 	if len(cfg.AllowedEmails) != 1 || cfg.AllowedEmails[0] != "guest@partner.com" {
 		t.Errorf("AllowedEmails = %v", cfg.AllowedEmails)
 	}
+	if len(cfg.DeniedEmails) != 2 || cfg.DeniedEmails[0] != "former@signal.org" || cfg.DeniedEmails[1] != "example@example.com" {
+		t.Errorf("DeniedEmails = %v", cfg.DeniedEmails)
+	}
 	if cfg.SessionTTL != 48*time.Hour {
 		t.Errorf("SessionTTL = %v", cfg.SessionTTL)
 	}